* origin/845LE.1.0-qualcomm:
i2c-msm-v2: Handle Null pointer de-reference
msm: camera: disable power collapse when camera is working
msm: camera: cci: Fix burst read sequence
msm: camera: cci: Modify condition check to read CCI data
xfrm: validate template mode
nl80211: nl80211_update_ft_ies to validate NL80211_ATTR_IE
msm: kgsl: Make sure gpu-speed-bin-vectors has the correct size
diag: Modify md_info and diag client map synchronization
ion: Ensure non-HLOS memory cannot be mapped by CPU
qseecom: fix kclient free issue in qseecom_remove
msm: camera: cci: Fix error check
msm: camera: eeprom: set platform driver data to null
msm: ipa: Protect ipa default routing table
ASoC: Fix UBSAN warning at snd_soc_get/put_volsw_sx()
drm/msm/dsi-staging: fix potential out of bounds memory accesses
Change-Id: I442530d8facd9487c5205797c7e6725bec1d9ffd
* origin/845LE.1.0-qualcomm: (22 commits)
diag: Prevent out of bound access while initializing msg mask
USB: core: only clean up what we allocated
crypto: qcedev: Add null pointer check on sg_src
msm: vidc: ignore processing responses in invalid state
msm: ipa: Validate routing rule id
drm/msm/dp: fix error checking for memory allocations
msm: camera: fix double free in jpeg mgr
msm: camera: Fix context refcount underflow
msm: ipa4: Fix dangling pointer dereferencing after NAT del cmd
drm/msm/dsi-staging: alter length to avoid stepping out of bounds
msm: camera: Add check for sensor data rate
net: core: null pointer derefernce in sockev_client_cb
msm: camera: Check for valid per frame i2c data.
net: memset smsg to avoid the padding data
msm: adsprpc: allocate all remote memory in kernel
drivers: Add flush_buffer for tty driver
net: ipc_router: Initialize the sockaddr in recvmsg() handler
msm: camera: Fix out-of-bounds read in string class name.
msm: mdss: use uaccess routines to access user space buffers
msm: camera: cpp: Check for valid tx level
...
Change-Id: If9fb2c1241478b6fc0ff74784484f24a4c5f3922
Total number of elements in the gpu-speed-bin-vectors array
should be multiple of number of elements in a speed bin vector.
If number of elements is not a multiple of vector size then
there is a possibilty of out of bound access in the speed-bin
vector array. Also rectify the memory allocated for it.
Change-Id: I9158e4f883eca400a46663b07326fb6f6020155c
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
Use correct indexing when using the contianer_of operation to
get the DSI clock manager handle to avoid potential out of
bounds memory accesses.
Change-Id: I8804c5ff2bb602527f84749116e1408513e22759
Signed-off-by: Aravind Venkateswaran <aravindh@codeaurora.org>
Memory allocation using kzalloc can return a valid pointer
when a zero size memory is requested. Therefore it is
important to use IS_ZERO_OR_NULL macro instead of just
checking for a null pointer prior to any use of the allocated
memory.
CRs-Fixed: 2279573
Change-Id: I3a9526347669d77bd5642195ab2681ef96ce580a
Signed-off-by: Aravind Venkateswaran <aravindh@codeaurora.org>
Limit max length of buffer while read misr configuration
from sysfs node.
Change-Id: I9adfd51da7ae77201cf6c0cf6e9af68785c7a063
Signed-off-by: Satya Rama Aditya Pinapala <psraditya30@codeaurora.org>
Add A504 to the list of chipsets where ME ucode
workarounds are applicable.
Change-Id: I524e59b92769368086825cd5540878ea98e6b7c9
Signed-off-by: Sunil Khatri <sunilkh@codeaurora.org>
There is a potential memory leak in ESD debugfs implementation,
in case if panel ESD trigger fails. This change fixes the same.
Change-Id: I6a136aad71aa5561709d539afc13d6591bc50d1f
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
report rsc timeout/success states to the
dependent components
Change-Id: Id2e85bcfbf7e0f07df436872583427ffa9bb3d87
Signed-off-by: Kalyan Thota <kalyant@codeaurora.org>
In case of 2 encoders + 2 DSI ctrls topology, mark display
having display_type as primary to be primary in display info
else mark it as secondary.
Change-Id: Ia1e4afda9e41466407fba3ad324e7dbf80b2e08c
Signed-off-by: Tharun Raj Soma <tsoma@codeaurora.org>
Input handler work is currently queue in disp thread.
There is corner case where if input event work is
queued to disp thread (commit thread) while going
into suspend (which happens in commit thread) then
deadlock might happen. Fix this by queueing input
handler into event thread.
Below is the stack trace:
Thread1:
__switch_to+0x90/0xc4
__schedule+0x2a8/0x824
schedule+0x38/0x9c
schedule_timeout+0x1d8/0x400
wait_for_common+0xb4/0x15c
wait_for_completion+0x14/0x1c
kthread_flush_work+0x100/0x178
msm_atomic_commit+0x8ac/0x8c4
drm_atomic_commit+0x50/0x5c
drm_mode_atomic_ioctl+0x8ec/0x958
drm_ioctl+0x1d0/0x430
do_vfs_ioctl+0xb8/0x800
SyS_ioctl+0x84/0x98
Thread2:
__switch_to+0x90/0xc4
__schedule+0x2a8/0x824
schedule+0x38/0x9c
schedule_timeout+0x1d8/0x400
wait_for_common+0xb4/0x15c
wait_for_completion+0x14/0x1c
kthread_flush_work+0x100/0x178
sde_encoder_virt_disable+0x184/0x2b8
msm_atomic_helper_commit_modeset_disables+0x160/0x570
complete_commit+0x6c/0x660
_msm_drm_commit_work_cb+0x40/0x1b8
kthread_worker_fn+0x88/0x1a8
kthread+0xe0/0xf4
cpu_switch_to+0x220/0x2490
Change-Id: If09bd1dfcffb20c4478a052bf7fd644fcf3dbf02
Signed-off-by: Jayant Shekhar <jshekhar@codeaurora.org>
In the current implementation dsi driver is always sending the
status check command in HS mode. This change fixes the issue by
setting the proper state based on panel device tree entry, before
sending the status check command from dsi host.
Change-Id: I9e8ed8616295de2a2f1d5fa2a8a83b706c70f033
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
In corner case where crtc->planemask and atomic state->planes[]
do not match, driver clears the multirect_index/multirect_mode
in the plane->state during validate failure case. This can lead
to multirect_index/multirect_mode mismatch for next commits during
failure condition.
Change-Id: Idccaa79431469e185ca46c1e40b040427d02a96d
Signed-off-by: Raviteja Tamatam <travitej@codeaurora.org>
SDE crtc module waits for previous frame done
before it triggers a new frame. This is unnecessary
because sde encoder has similar wait already within
prepare_kickoff API call. This patch avoids extra
frame done wait and only flush the event thread
to trigger pending fences.
Change-Id: I45b6dcd5ec39491303fe29eaaf41988a68f48465
Signed-off-by: Dhaval Patel <pdhaval@codeaurora.org>
This change ties up the dsi irq line disable/enable control
to core clock disable/enable sequence.
Change-Id: I2c59799dbd7efd1ca35e996057370bc9b6956cf5
Signed-off-by: Sandeep Panda <spanda@codeaurora.org>
Fix the Concurrent Writeback feature enabled validation
to check if CWB feature bit set in the Writeback feature flag.
Change-Id: Iffd3167b500edaa3c3338094eadcdc08606ff5c1
Signed-off-by: Prabhanjan Kandula <pkandula@codeaurora.org>
